ci: bump actions/checkout from 6 to 7#12
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
📝 WalkthroughWalkthroughAll GitHub Actions workflow files ( Changesactions/checkout v6 → v7 upgrade
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 47: Replace all instances of `actions/checkout@v7` with a pinned commit
SHA reference instead of the tag-based version to eliminate mutable-tag
supply-chain risk. Additionally, add `persist-credentials: false` to the `with:`
configuration for every checkout step to disable GITHUB_TOKEN credential
persistence for subsequent git operations. Apply this pattern consistently to
all checkout steps throughout the workflow file.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: fb51c249-4004-46eb-b450-d3169e671abc
📒 Files selected for processing (7)
.github/workflows/ci.yml.github/workflows/coverage.yml.github/workflows/integration.yml.github/workflows/nightly.yml.github/workflows/pre-commit-ci.yml.github/workflows/release-publish.yml.github/workflows/release.yml
|
@dependabot rebase |
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
daccd07 to
8bdb662
Compare
…rsistence All actions/checkout@v7 steps in ci.yml were tag-pinned (mutable) and did not set persist-credentials: false, exposing the workflow to upstream tag retargeting and leaving GITHUB_TOKEN available to subsequent git operations in the same job. No step in this file performs git push/commit, so disabling credential persistence has no functional impact. Addresses CodeRabbit review (zizmor: unpinned-uses, artipacked) on this PR. Remediation-Cycle: #12/cycle-1 Co-authored-by: Cursor <cursoragent@cursor.com>
|
Remediation cycle 1 — summaryFindings processed: 1
Verification: SHA Thread resolved. Waiting on CI to confirm green on the new commit. |
1 participant
Bumps actions/checkout from 6 to 7.
Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)